This vulnerability in 1millionbot Millie chat (v3.6.0) is an authorization bypass due to improper access control on the 'api.1millionbot.com/api/public/conversations/' endpoint. By manipulating the conversation ID parameter, an attacker can retrieve private conversations belonging to other users without authentication. The flaw is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS 4.0 score is 7, reflecting network attack vector, high attack complexity, and no privileges or user interaction required, but with high scope and impact on confidentiality and integrity.

Successful exploitation allows a remote attacker to view private chatbot conversations of other users, potentially exposing sensitive or confidential information. No authentication or user impersonation is needed, only knowledge of a valid conversation ID. This compromises user privacy and data confidentiality within the affected version of the product.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable API endpoint and monitor for unauthorized access attempts. Avoid sharing conversation IDs publicly or insecurely to reduce risk of exploitation.